Watermarking using multiple watermarks and keys, including keys dependent on the host signal

ABSTRACT

A method of embedding a watermarking in a host signal computes a first watermark depending on a particular party and computes a second watermark depending on the host signal. The method embeds the first and second watermarks in the host signal. At least one of the watermarks is embedded using a key derived from the host signal. In particular, one of the watermarks is embedded with a key derived from the host signal.

RELATED APPLICATION DATA

This application is a continuation in part of U.S. patent applicationSer. No. 10/360,794, filed Apr. 30, 2001, which is acontinuation-in-part of application Ser. No. 08/921,931, filed Aug. 27,1997 (now U.S. Pat. No. 6,226,387), which claims priority to provisionalapplications 60/050,587, filed Jun. 24, 1997, and 60/024,979, filed Aug.30, 1996.

U.S. patent application Ser. No. 10/360,794 is also acontinuation-in-part of application Ser. No. 08/918,126, filed Aug. 27,1997 (now U.S. Pat. No. 6,272,634), which claims priority to provisionalapplications 60/050,587, filed Jun. 24, 1997, and 60/024,979, filed Aug.30, 1996.

U.S. patent application Ser. No. 10/360,794 is also acontinuation-in-part of application Ser. No. 08/918,125, filed Aug. 27,1997 (now U.S. Pat. No. 6,282,299), which claims priority to provisionalapplications 60/050,587, filed Jun. 24, 1997, and 60/024,979, filed Aug.30, 1996.

The above applications and patents are incorporated by reference.

GOVERNMENT RIGHTS STATEMENT

The inventions detailed in this application was made with governmentsupport by AFOSR under grant AF/F49620-94-1-0461, and ARPA GRANT No.USDOC6NANB2D1272. The Government has certain rights in this invention.

FIELD OF THE INVENTION

This invention relates generally to techniques for embedding data suchas watermarks, signatures and captions in digital data, and moreparticularly to digital watermarking to resolve multiple claims ofownership.

BACKGROUND OF THE INVENTION

The world wide web, Internet, and many other distributed networkscontinue to provide opportunities for new and improved digitalinformation dissemination. Digital audio, video, and images may beeasily distributed, reproduced, and manipulated. However, theseefficiencies also increase the problems associated with copyrightenforcement. For this reason, creators and distributors of digital dataare hesitant to provide access to their intellectual property. Reliablesolutions to the problems associated with copyright protection ofmultimedia data are actively being pursued.

Digital watermarking has been proposed as a means to identify the owneror distributor of digital data. Watermarking is the process of encodinghidden copyright information in digital data by making smallmodifications to the data samples. Unlike encryption, watermarking doesnot restrict access to the data. Once encrypted data is decrypted, themedia is no longer protected. A watermark is designed to permanentlyreside in the host data. When the ownership of a digital work is inquestion, the information can be extracted to characterize the owner.

A digital watermark is designed to be perceptually and statisticallyinvisible with the host media (e.g., image, audio, or video). Thisensures that the watermark does not degrade the host media. It alsohelps to prevent illegal removal of the copyright protection by a“pirate.” The watermark is also designed to be robust to signaldistortions, incidental and intentional, applied to the host data.Possible distortions include normal signal processing operations, e.g.,coding, filtering, scaling, etc., and deliberate attempts to forge,remove, or invalidate the watermark. Generally, a resourceful pirate mayuse a variety of signal processing operations to attack a digitalwatermarking. A pirate may attempt to defeat a watermarking procedure inthree ways: (1) damage the host media to make the watermarkundetectable, (2) establish that the watermarking scheme is unreliable,i.e., it detects a watermark when none is present.

Finally, (3) the extracted watermark must also correctly identify theowner and solve the deadlock issue when multiple parties claim ownershipof a digital work. A deadlock may occur when a second party watermarksanother person's data, thereby asserting unlawful ownership of another'sintellectual property. That is, the main function of a watermarkingalgorithm is to unambiguously establish and protect ownership of data.However, many current watermarking schemes are unable to resolverightful ownership of digital data when multiple ownership claims aremade, i.e., when a deadlock problem arises. The inability to deal withdeadlock is independent of how the watermark is inserted in the digitaldata or how robust it is to various types of modifications.

Watermarking techniques which do not require the original(non-watermarked) signal are the most vulnerable to ownership deadlocks.A pirate simply adds his or her watermark to the watermarked data. Thedata now has two watermarks. Prior art watermarking schemes aretypically unable to establish who watermarked the data first.

Watermarking procedures that require the original data set for watermarkdetection also suffer from deadlocks. In such schemes, a party otherthan the owner may counterfeit a watermark by “subtracting off” a secondwatermark from the publicly available data and claim the result to behis or her original. This second watermark allows the pirate to claimcopyright ownership since he or she can show that both the publiclyavailable data and the original of the rightful owner contain a copy oftheir counterfeit watermark.

It would seem that the original (non-watermarked) media should be ableto resolve the deadlock issue. Party A should have an original S_(orig)which does not contain Party B's watermark. On the other hand, Party B's“original” must have Party A's watermark, since it is derived from thedata Party A watermarked and distributed. However, current watermarkingtechniques are susceptible to an intelligent attack by Party B whichdestroys this logic. In particular, Party B can create a watermark W^(B)which shows up in Party A's original S_(orig). Both originals, one fromeach party, contains the others watermark. Thus, a deadlock is created.

Party B's watermark is created by “subtracting off” a second watermarkfrom the publicly available data. The difference is declared Party B's“original.” For example, suppose Party A watermarks data S_(orig) ^(A)using their watermark W^(A), and allows the watermarked dataS _(water) ^(A) =S _(orig) ^(A) +W ^(A)to be accessible to the public, Party B takes the watermarked dataS_(water) and creates their own “original” data S_(water) ^(B) bysubtracting off a second watermark W^(B):S _(orig) ^(B) =S _(water) ^(A) −W ^(B).

Thus, both watermarks W^(A) and W^(B) exist in the publicly availabledata S_(water) ^(A):S _(water) ^(A) =S _(orig) ^(A) +W ^(A) =S _(orig) ^(B) +W ^(B).

When S_(water) ^(A) is tested for W^(A) and W^(B), both will bepositively identified. The originals from each party may be consulted.Party A can find their watermark W^(A) in Party B's original asS _(orig) ^(B) −S _(orig) ^(A)=(S _(water) ^(A) −W ^(B))−S _(orig)^(A)=(S _(orig) ^(A) +W ^(A))−W ^(B) −S _(orig) ^(A) =W ^(A) −W ^(B).

However, Party B can find their watermark W^(B) in Party A's original,asS _(orig) ^(A) −S _(orig) ^(B) =S _(orig) ^(A)−(S _(water) ^(A) −W^(B))=S _(orig) ^(A)−(S _(orig) ^(A) +W ^(A))+W ^(B) =W ^(B) −W ^(A).

As a result, this second watermark allows the pirate to claim copyrightownership since he or she can show that both the publicly available dataand the original of the rightful owner contain a copy of theircounterfeit watermark. Thus, there is a need for watermarking proceduresapplicable to digital data that do not suffer from the describedshortcomings, disadvantages and problems.

SUMMARY OF THE INVENTION

One aspect of the invention is a method of embedding a watermarking in ahost signal. This method computes a first watermark depending on aparticular party and computes a second watermark depending on the hostsignal. The method embeds the first and second watermarks in the hostsignal.

At least one of the watermarks is embedded using a key derived from thehost signal. In particular, one of the watermarks is embedded with a keyderived from the host signal.

Another aspect of the invention is a method of digital watermarking amedia signal comprising deriving a first key that is a function of themedia signal; generating a digital watermark signal that is a functionof the first key and a second key that is not dependent on the mediasignal; and embedding the digital watermark in the media signal.

Another aspect of the invention is a method of detecting a digitalwatermark in a host signal comprising obtaining a first key that is afunction of the host signal; generating a representation of a digitalwatermark from the first key and a second key that is not dependent onthe host signal; and processing the host signal with the representationof the digital watermark to extract the digital watermark from the hostsignal.

In one embodiment of the invention, an author representation is based onthe host digital data signal. An author is represented with apseudo-random sequence (i.e., the watermark) created by a pseudo-randomgenerator and two keys. One key is author dependent, while the secondkey is signal dependent. The representation is able to resolve rightfulownership in the face of multiple ownership claims.

In another embodiment of the invention, a watermarker uses two or morewatermarks. A watermarking scheme uses the original signal to detect thepresence of a watermark. This watermark is integrated with a secondwatermark that does not require the original signal. These embodimentsof the invention solve the deadlock problem described in the backgroundsection of the application.

Further aspects, advantages and embodiments of the invention will becomeapparent by reference to the drawings, and by reading the followingdetailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1( a) is a diagram of a system to embed a watermark in digital hostdata, according to an embodiment;

FIG. 1( b) is a diagram of a system of a system to detect and compare awatermark embedded in digital host data, according to an embodiment;

FIG. 2 is a diagram of a typical computer to be used with embodiments ofthe invention;

FIG. 3 is a diagram of a watermarker to resolve the deadlock issueaccording to one embodiment; and,

FIG. 4 is a diagram of a watermark generator to generate watermarks soas to resolve the deadlock issue according to one embodiment.

DETAILED DESCRIPTION OF THE INVENTION

In the following detailed description of the preferred embodiments,reference is made to the accompanying drawings which form a part hereof,and in which is shown by way of illustration specific preferredembodiments in which the invention may be practiced. These embodimentsare described in sufficient detail to enable those skilled in the art topractice the invention, and it is to be understood that otherembodiments may be utilized and that logical, mechanical and electricalchanges may be made without departing from the spirit and scope of thepresent invention. The following detailed description is, therefore, notto be taken in a limiting sense.

Overview of the Watermarking and Watermark Detecting Processes

A watermarking system for digital media consists of two parts: (1)embedding the watermark in digital host data, and (2) detecting thewatermark within the digital host data to identify the owner. The firstpart is described in reference to FIG. 1( a), whereas the second part isdescribed in reference to FIG. 1( b). A diagram of a system to embed awatermark in digital host data is shown in FIG. 1( a). The multimediadigital host data to be watermarked may be an image, an audio clip, or avideo sequence. S_(orig) denotes the original multimedia signal withoutany watermark. Furthermore, W denotes the watermark which the ownerwishes to embed and S_(water) denotes the signal with the embeddedwatermark. Watermarker 10 embeds the watermark into the original signalto produce the watermarked signal. Watermarker 10 may be a computerizedsystem, having hardware and/or software components; the invention is notso particularly limited. The watermark W is embedded into S_(orig) by anembedding function performed by watermarker 10 and generally written asE(S _(orig) ,W)=S _(water).

The embedding function E makes small modifications to S_(orig) accordingto W. For example, if W=(W₁, W₂, . . . )=(1,0,1,1,0, . . . ), theembedding function may add or subtract a small amount α from each pixelor sample of S_(orig) according to whether W₁=1 or 0.

Referring next to FIG. 1( b), a diagram of a system to detect andcompare a watermark embedded in digital host data is shown. Detector 12extracts a sequence W′ from a received signal R being tested, usingknowledge of W and possibly S_(orig). Detector 12 may be a computerizedsystem, having hardware and/or software components; the invention is notso particularly limited. The sequence W′ is extracted by a detectingfunction performed by detector 12 and generally written asD(R,S _(orig.))=W′.

The test signal R may or may not be the watermarked (and possiblydistorted) signal S_(water). Comparator 14 compares the extractedsequence W′ with the original watermark W to determine whether therecovered signal is watermarked. Comparator 14 may be a computerizedsystem, having hardware and/or software components; the invention is notso particularly limited. The comparison performed by comparator 14 is inone embodiment a correlation measure C and a binary decision is made:

${c\left( {W^{\prime},W} \right)} = \left\{ \begin{matrix}{1,} & {c \geq \alpha} \\{0,} & {otherwise}\end{matrix} \right.$where c is the value of the correlation and α is a threshold. A ‘1’indicates a watermark was detected, while a ‘0’ indicates that nowatermark was detected. In other words, if W and W′ are sufficientlycorrelated (greater than some threshold), the signal is declaredwatermarked and the author has ownership rights to the media. Otherwisethe media R is deemed free from copyright protection.

The invention is not particularly limited to any three-tuple (E, D, C)computerized system for embedding, detecting, and comparing purposes.That is, any watermark technique, characterized in terms of thethree-tuple (E, D, C) as described above may be amenable to theinvention as otherwise described in this application. Specifically,inasmuch as any watermark technique is amenable to resolve the deadlockissue as has been described (i.e., resolve multiple claims ofownership), the technique may be used to make an embodiment.

Several watermarking techniques in general are known within the art.Many such techniques are based on adding fixed amplitude pseudo-noise(PN) sequences to an image. In this case, E and D are simply theaddition and subtraction operators, respectively. PN sequences are alsoused as the “spreading key” when considering the host media as the noisein a spread spectrum system, where the watermark is the transmittedmessage. In this case, the PN sequence is used to spread the data bitsover the spectrum to hide the data. When applied in the spatial ortemporal domains, these approaches modify the least significant bits(LSB) of the host data. Invisibility of the watermark is based on theassumption that the LSB data are insignificant. The watermark isgenerally recovered using knowledge of the PN sequence (and perhapsother secret keys, like watermark location) and the statisticalproperties of the embedding process.

Several spatial techniques for watermarking also exist in the art. Forexample, a statistical technique may be used which randomly chooses npairs (a_(i),b_(i)) of points in an image and increases the brightnessof by one unit a_(i) while simultaneously decreasing the brightness ofb_(i). Another such technique hides data by mapping a random texturepattern in an image to another region in the image with a similartexture pattern. This method is limited to images that possess largeareas of random texture.

In other copyright protection schemes, the watermarks are made to appearas quantization noise when embedded into the images. A predictive codingscheme may be used to embed the watermark into the image. Or, thewatermark may be embedded into the image by dithering the image based onthe statistical properties of the image. In another scheme, a watermarkfor an image is generated by modifying the luminance values inside 8×8blocks of pixels, adding one extra bit of information to each block. Thechoice of the modified block is secretly made by the encoder.

Furthermore, the Xerox Data-Glyph technology, known within the art, addsa bar code to its images according to a predetermined set of geometricmodifications. In another scheme, data is hidden in the chrominancesignal of NTSC by exploiting the temporal over-sampling of color. Stillanother watermarking scheme provides for constructing a watermark byconcealing graph data in the LSB's of the image.

Transform based watermarking techniques have also been proposed in theart. To embed a watermark, a transformation is applied to the host data,and modifications are made to the transform coefficients. Possible imagetransformations include the FFT, discrete cosine transform (DCT),wavelet, subband, Hadamard, and others. A JPEG model based, frequencyhopped, randomly sequenced pulse position modulated code is posited inaccordance with one particular approach. The approach modifies thedifference between randomly selected mid frequency components in randomimage blocks. Setting linear or circulant constraints on the middlefrequency DCT coefficients of random image blocks is done in onespecific scheme. In another scheme, the middle band DCT coefficients ofimage blocks are modified to hold signature data.

Another watermarking scheme proffers a codeword that is generated andused to modulate selected coefficients of the DCT or wavelet transformof a block in an image. In a different scheme, the scheme causesperturbance of the phase of FFT coefficients of 8×8 image blocks toembed a watermark. The largest DCT components of an image are modifiedby Gaussian noise in one particular watermarking scheme. Another schemeembeds digital data into analog TV signals. The method substituteshigh-spatial frequency image data for “hidden” data in a pyramid-encodedimage. A phase coding approach is used in a different scheme to embed awatermark in audio signals. The data is embedded by modifying the phasevalues of Fourier Transform coefficients of audio segments. Anotheraudio watermarking technique is proposed replaces Fourier Transformcoefficients over the middle frequency bands with the signature spectralcomponents. A method to watermark compressed video by modifying the MPEGbitstream is also in a scheme within the art.

All such watermarking, detecting and comparing schemes may be amenableto the resolution of deadlock. Furthermore, in particular, sound, image,and video watermarking embodiments described in the priority andincorporated patents and applications are specifically amenable to theinvention. These embodiments ensure robust and imperceptible watermarks.

Hardware Implementation of the Invention

The invention is not limited as to the type of computer on which itruns. However, a typical example of such a computer is shown in FIG. 2.Computer 16 is a desktop computer, and may be of any type, including aPC-compatible computer, an Apple Macintosh computer, a UNIX-compatiblecomputer, etc. Computer 16 usually includes keyboard 18, display device20 and pointing device 22. Display device 20 can be any of a number ofdifferent devices, including a cathode-ray tube (CRT), etc. Pointingdevice 22 as shown in FIG. 2 is a mouse, but the invention is not solimited. Not shown is that computer 16 typically also comprises arandom-access memory (RAM), a read-only memory (ROM), acentral-processing unit (CPU), a fixed storage device such as a harddisk drive, and a removable storage device such as a floppy disk drive.The computer program to implement the invention is typically written ina language such as C, although the invention is not so limited.

The specifics of the hardware implementation have been described. Aparticular implementation is now described.

Implementation of the Invention Resolving the Deadlock Issue

Referring to FIG. 3, a diagram of a watermarker, which may be used aswatermarker 10, to resolve the deadlock issue according to oneembodiment of the invention is shown. For example, two parties may claimownership of an audio clip. To determine the rightful owner of the audioclip, an arbitrator examines only the audio clip in question, theoriginals of both parties and the key used by each party to generatetheir watermark.

The dual watermark approach of FIG. 3 employs a pair of watermarks, oneembedded by sub-watermarker 24, and another embedded by sub-watermarker26. Each of sub-watermarker 24 and sub-watermarker 26 may be acomputerized system, having hardware and/or software components; theinvention is not so particularly limited. The watermarking procedurefollowed by sub-watermarker 24 requires the original data set forwatermark detection. Sub-watermarker 24 embeds watermark W1 withinS_(orig) in accordance with an amenable watermarking scheme, as havebeen described, to which the invention is not particularly limited.

The second watermarking procedure followed by sub-watermarker 26 doesnot require the original data set and hence, is a more simple datahiding procedure. Sub-watermarker 26 embeds watermark W2 within S_(orig)in which W1 has already been embedded. Any number of procedures can beused to insert the second watermark, as have been described, and theinvention is not particularly limited. The output of sub-watermarker 26is S_(water), which is the original signal including both embeddedwatermarks.

The second watermark need not be highly robust to editing of the datasegment since it is meant to protect the data that a pirate claims to behis original. The robustness level of many watermarking techniques thatdo not require the original for watermark detection is quite adequate.The arbitrator would expect the original to be of a high enough quality.This limits the operations that a pirate can apply to a host data andstill claim it to be his high quality original data. The watermark thatrequires the original audio sequence for its detection is very robust.

In case of deadlock, the arbitrator first checks for the watermark thatrequires the original for watermark detection. If the pirate is cleverand has used the attack suggested in and outlined above, the arbitratorwould be unable to resolve the deadlock with this first test. Thearbitrator then checks for the watermark that does not require theoriginal audio sequence in the audio segments that each ownershipcontender claims to be his original. Since the original audio sequenceof a pirate is derived from the watermarked copy produced by therightful owner, it will contain the watermark of the rightful owner. Onthe other hand, the true original of the rightful owner will not containthe watermark of the pirate since the pirate has no access to thatoriginal and the watermark does not require subtraction of another dataset for its detection.

Besides dual watermarking, there is another approach to resolvedeadlock: a dependent watermarking scheme. Referring now to FIG. 4, adiagram of a watermark generator, to generate such watermarks as W1(and, alternatively, also W2), so as to resolve the deadlock issueaccording to one embodiment, is shown. That is, further protectionagainst deadlock is provided by the technique used to select thepseudo-random sequence that represents the author (i.e., the sequencebeing the watermark).

Specifically, the author has two random keys x₁ and x₂ (i.e., seeds)from which a pseudo-random sequence y can be generated using watermarkgenerator 28, which in one embodiment is a suitable pseudo-randomsequence generator. Watermark generator 28 may be a computerized system,having hardware and/or software components; the invention is not soparticularly limited. Popular generators include RSA, Rabin,Blum/Micali, and Blum/Blum/Shub, all of which are known within the art.With the two proper keys, the watermark may be extracted. Without thetwo keys, the data hidden in the audio is statistically invisible andimpossible to recover. Note that this embodiment does not use theclassical maximal length pseudo noise sequence (i.e., m-sequence)generated by linear feedback shift registers to generate a watermark.Sequences generated by shift registers are cryptographically insecure:one can solve for the feedback pattern (i.e., the keys) given a smallnumber of output bits y.

The noise-like sequence y, after some processing, is the actualwatermark hidden into the data stream. The key x₁ is author dependent,and is thus shown in FIG. 4 as directly being input into generator 28without being output by a specific generator itself. Conversely, the keyx₂ is signal dependent. The key x₂ is generated by signal-dependent keygenerator 30, which has as an input the original signal S_(orig).Generator 30 may be a computerized system, having hardware and/orsoftware components; the invention is not so particularly limited. Thus,watermark generator 28 generates a watermark y, which may be used aswatermark W₁ or W₂, in the context of the watermarker of FIG. 3, basedon the input of x₁ and the output x₂ of generator 30.

The key x₁ is assigned to (or chosen by) the author (that is, related tothe author). Key x₂ is computed from the signal which the author wishesto watermark. It is computed from the host signal using a one-way hashfunction, by generator 28. In one embodiment, the tolerable error levelssupplied by the masking models described in Swanson, Zhu, and Tewfik,“Transparent Robust Image Watermarking,” in Proceedings 1996International Conference on Image Conferencing, Volume III (Lausanne,Switzerland), pp. 211-214, 1996; Boney, Tewfik, and Hamdy, “DigitalWatermarks for Audio Signals,” in Proceedings 1996 IEEE InternationalConference on Multimedia Comp. and Systems (Hiroshima, Japan), pp.473-480, 1996; and, Swanson, Zhu, and Twefik, “Object-based TransparentVideo Watermarking,” in Proceedings 1997 IEEE Multimedia SignalProcessing Workshop Princeton, N.J.), pp. 369-374, 1997; all threereferences which are hereby incorporated by reference, are hashed to akey x₂. Furthermore, any one of a number of secure one-way hashfunctions known in the art may be used to compute x₂, including thoseknown as RSA, MD4, and SHA. For example, the Blum/Blum/Shubpseudo-random generator uses the one way function y=g_(n)(x)=x² mod, n,where n=pq for primes p and q so that p=3 mod 4. It is known thatgenerating x or y from partial knowledge of y is computationallyinfeasible for the Blum/Blum/Shub generator.

The signal dependent key x₂ generated by generator 30 makescounterfeiting very difficult. The pirate can only provide key x₁ to thearbitrator. Key x₂ is computed by the watermarking algorithm from theoriginal signal. The pirate generates a counterfeit original bysubtracting off a watermark. However, the watermark (partially generatedfrom the signal dependent key) depends on the counterfeit original.Thus, the pirate must generate a watermark which creates a counterfeitoriginal which, in turn, generates the watermark. As it iscomputationally infeasible to invert the one-way hash function, thepirate is unable to fabricate a counterfeit original which generates thedesired watermark. Thus, the dual-watermarking and the hostsignal-dependent key embodiments solve the deadlock problem.

Although specific embodiments have been illustrated and describedherein, it will be appreciated by those of ordinary skill in the artthat any arrangement which is calculated to achieve the same purpose maybe substituted for the specific embodiments shown. This application isintended to cover any adaptations or variations of the presentinvention. Therefore, it is manifestly intended that this invention belimited only by the following claims and equivalents thereof.

What is claimed is:
 1. A method of embedding a watermarking in a hostsignal, the method comprising: computing a first watermark depending ona particular party; computing a second watermark depending on the hostsignal; and embedding the first and second watermarks in the hostsignal; wherein the second watermark is embedded using a key derivedfrom the host signal, and wherein the key is derived from the hostsignal by inputting a perceptual hash of the host signal into a keygenerator to generate the key.
 2. A method of embedding a watermarkingin a host signal, the method comprising: computing a first watermarkdepending on a particular party; computing a second watermark dependingon the host signal; and embedding the first and second watermarks in thehost signal; wherein the second watermark is computed based on a hash ofthe host signal.
 3. The method of claim 2 wherein the hash comprises ahash of an output of a masking model applied to the host signal.
 4. Amethod of embedding a watermarking in a host signal, the methodcomprising: computing a first watermark depending on a particular party;computing a second watermark depending on the host signal; and embeddingthe first and second watermarks in the host signal; wherein the secondwatermark is embedded using a key derived from the host signal, andwherein the key is derived using a masking model applied to the hostsignal.
 5. A method of embedding a watermarking in a host signal, themethod comprising: computing a first watermark depending on a particularparty; computing a second watermark depending on the host signal; andembedding the first and second watermarks in the host signal; whereinthe first watermark identifies a distributor of the host signal and isdependent on a key assigned to the distributor.
 6. A method of embeddinga watermarking in a host signal, the method comprising: computing afirst watermark depending on a particular party; computing a secondwatermark depending on the host signal; and embedding the first andsecond watermarks in the host signal; wherein the first and secondwatermarks are both dependent on plural keys, wherein at least one ofthe plural keys for each of the first and second watermarks is derivedfrom a function of the host signal.
 7. The method of claim 6 wherein thefunction of the host signal comprises a hash of the host signal.
 8. Themethod of claim 7 wherein the hash comprises a hash of output of a maskapplied to the host signal.
 9. A non-transitory computer readable mediumon which is stored instructions, which when executed by a computer,perform a method of embedding a watermarking in a host signal, themethod comprising: computing a first watermark depending on a particularparty; computing a second watermark depending on the host signal; andembedding the first and second watermarks in the host signal; whereinthe second watermark is embedded using a key derived from the hostsignal wherein the key is derived from the host signal by inputting aperceptual hash of the host signal into a key generator to generate thekey.
 10. A non-transitory computer readable medium on which is storedinstructions, which when executed by a computer, perform a method ofembedding a watermarking in a host signal, the method comprising:computing a first watermark depending on a particular party; computing asecond watermark depending on the host signal; and embedding the firstand second watermarks in the host signal; wherein the second watermarkis computed based on a hash of the host signal.
 11. The computerreadable medium of claim 10 wherein the hash comprises a hash of anoutput of a masking model applied to the host signal.
 12. Anon-transitory computer readable medium on which is stored instructions,which when executed by a computer, perform a method of embedding awatermarking in a host signal, the method comprising: computing a firstwatermark depending on a particular party; computing a second watermarkdepending on the host signal; and embedding the first and secondwatermarks in the host signal; wherein the second watermark is embeddedusing a key derived from the host signal wherein the key is derivedusing a masking model applied to the host signal.
 13. A non-transitorycomputer readable medium on which is stored instructions, which whenexecuted by a computer, perform a method of embedding a watermarking ina host signal, the method comprising: computing a first watermarkdepending on a particular party; computing a second watermark dependingon the host signal; and embedding the first and second watermarks in thehost signal; wherein the first watermark identifies a distributor of thehost signal and is dependent on a key assigned to the distributor.
 14. Anon-transitory computer readable medium on which is stored instructions,which when executed by a computer, perform a method of embedding awatermarking in a host signal, the method comprising: computing a firstwatermark depending on a particular party; computing a second watermarkdepending on the host signal; and embedding the first and secondwatermarks in the host signal; wherein the first and second watermarksare both dependent on plural keys, wherein at least one of the pluralkeys for each of the first and second watermarks is derived from afunction of the host signal.
 15. The computer readable medium of claim14 wherein the function of the host signal comprises a hash of the hostsignal.
 16. The computer readable medium of claim 15 wherein the hashcomprises a hash of output of a mask applied to the host signal.